Lessons from Grangemouth

The report describes the causes of the incidents in May and June 2000 - a power distribution failure that caused refinery shutdown, failure of a steam main resulting in minor injury to a member of the public and a serious fire at a process unit.

Electrical failure

On the evening of 29 May 2000, all electrical power was lost to several substations that supply the north side of the Grangemouth complex containing the oil refinery and chemical and utility plants. An emergency shutdown of the refinery and the chemical plants took place. The utility plants were affected by the loss of power to the main cooling water pumping systems; other areas of the complex had to be shut down because the loss of the steam supply meant that the flare system could not be maintained. No one was injured.

The loss of electrical power was caused by damage to a 33kV underground cable during the excavation of a trench to install a new cable adjacent to existing ones. Water was able to penetrate the damaged cable sheathing, allowing the current to run to earth. The local circuit-breaker, which should have isolated the relevant part of the distribution system, did not operate because it had been disabled. Two other circuit-breakers in the system then tripped to clear the fault, resulting in the loss of power to large parts of the complex.

Before the excavation started, operatives from the excavation contractor were given a "toolbox talk" that identified the correct tools and the way they were to be used in the excavation work. Operatives were allowed to break the ground surface to a depth of 300mm using a compressed-air power tool known as a clayspade, which was not to be used below this depth to avoid damage to existing cables. Nevertheless, evidence indicates that the earth fault resulted from the cable being damaged with a clayspade. Supervision during the excavation work was limited: the supervisors from the excavation contractor and BP Construction did not provide continuous on-site supervision.

Once water had penetrated the cable, the fault should have been detected by the 33kV circuit-breaker in the local electricity substation. Had this happened, power supply to the oil refinery area would have been maintained. The CA investigation found no evidence that the relay was disabled for malicious intent or in conjunction with the failure of the 33kV cable. It is possible that it occurred during performance testing in the 1980s, although the CA concludes that it is difficult to envisage how plastic inserts disabling the circuit-breaker would not have been noticed during subsequent testing.

The CA suggests that there were major weaknesses in the safety management systems, particularly in organising (communication, control and competency), in planning and implementing and in monitoring.

Specific examples include:

The CA concludes that these failures and their underlying causes demonstrated a failure in BP's control of contractors and in the management of change in this incident.

A previous power failure incident occurred in July 1999. This resulted in a loss of steam, plant shutdowns and significant flaring. On this occasion, the plant emergency shutdown systems and the uninterruptible power supply on the whole operated effectively, preventing any further consequences.

Steam main rupture

In the late evening of 7 June 2000, an 18-inch medium pressure (MP) steam main adjacent to a main road burst. The steam leak damaged fencing next to it, and debris and steam were blown across the road until the leak was isolated. A member of the public walking a dog 300m away tripped over the dog and sustained rib injuries. The steam supply was disrupted until the leak was isolated and repaired.

The power distribution failure on 29 May resulted in water drainage pumps being unavailable. This caused flooding of service tunnels carrying MP steam distribution lines. During investigations to see if the flooding had caused damage to pipework, a steam trap, which allows condensed hot water to escape from the system, was closed to allow safe inspection. This trap was not subsequently reopened and the rising levels of hot water trapped a bubble of steam in the pipework. This bubble eventually collapsed causing a phenomenon known as "condensation-induced water hammer". This led to gross overpressure in the pipework and its catastrophic failure.

The CA concludes that the safety management system governing operation of the MP steam line had major weaknesses in organising (particularly communication, control, competence and coordination), in planning and implementing and in monitoring and review. Underlying problems involved:

In the week prior to the failure, downstream pipework had suffered significant water hammer and condensate was ejected from a pressure relief valve. Action was taken to isolate that particular section of pipework from the network, but the investigation into the upset was incomplete and inadequate. Another section of the same MP steam line failed in January 1975 due to severe water hammer. Many of the recommendations made following this incident were relevant to the June 2000 incident, but appeared not to have been followed.

Cat Cracker fire

The Fluidised Catalytic Cracker Unit (FCCU) within the oil refinery had been shut down on 29 May 2000 as a result of the power distribution failure. FCCUs are standard installations used throughout the world on oil refineries for converting the heaviest components of crude oil into useful products, such as motor fuels. There is also a worldwide history of operational incidents involving FCCUs, including at the Grangemouth complex, and information is widely publicised and readily available.

In the early hours of 10 June 2000, during start-up procedures commenced the day before, there was a significant leak of hydrocarbons from the FCCU. These created a vapour cloud that ignited, causing a serious fire. On- and off-site emergency services brought the fire under control in 90 minutes and extinguished it by mid-morning.

During the fire, some asbestos cladding on pipework and vessels was damaged and hydrocarbons in contaminated firewater were discharged directly into the River Forth. No one was injured; workers followed the emergency response procedures, but there was potential for injury to people and greater damage to equipment.

Investigations found that the leak that led to the fire was caused by the failure of a T-piece connection in pipework. This had been installed in the 1950s and, although the correct type of T-piece had been specified, this was not the type fitted. No subsequent changes were made to plant layout drawings to identify this change.

Later modifications to the pipework had left the T-piece and other pipework inadequately supported. Further modifications to the FCCU in 1996 and 1998 had resulted in it being increasingly difficult to operate reliably and, although designed to run continuously, it was subject to an increased number of startup and shutdown cycles.

Failure of the T-piece was probably caused by a combination of the wrong T-piece connection, inadequate support for the pipework and cyclic stresses and vibration caused by the more frequent starting and stopping of the unit. Eventually this led to fatigue failure of the pipework.

The four or five workers in the immediate vicinity only escaped fatal or serious injury because of a combination of the way in which the fire started and progressed, their positioning at the time of the incident and their presence of mind in moving to safe positions. Weather conditions assisted, and the vapour did not accumulate in and around the buildings or in the plant. Under different circumstances, this could have led to a vapour cloud explosion, which would have increased the likelihood of fatal injuries and escalation of the incident.

The CA concludes that there were major weaknesses in failing to organise to meet the high standards required by COMAH and in planning and implementing and in monitoring, audit and review. Underlying problems were identified in:

The FCCU safety report for 1997/98 concludes that: "Hardware and software controls in place on the FCCU are adequate to prevent the occurrence of a major accident that could affect the general public, the personnel working on-site or the environment around it." The findings of the investigation show that this conclusion was partly unjustified even in 1997 when it was submitted, and certainly did not reflect the reality by 10 June 2000, when the cumulative effects of unreliability, numerous plant startups, vibration and unsupported pipework factors came together.

The safety report was not proactively used as a management standard for reviewing continued safe operation, nor used as an audit tool to verify the claims made for safe operation. There were serious deficiencies in the COMAH compliance regime and the safety report did not reflect the reality of the plant operations and maintenance. Additionally, a number of incidents involving vibration had occurred during the previous two years.

Common themes

The investigations also identified common themes relating to the health, safety and environmental management system at Grangemouth. These were:

Immediately after the incidents, BP formed a taskforce to review all of its operations and organisation at Grangemouth and to come up with recommendations for achieving high standards of safety and environmental performance. This group comprised 30 experts from within BP and from external bodies. BP accepted all the recommendations, and the CA report concludes that the taskforce's findings and recommendations properly address the way forward to ensure safe and reliable operations at the Grangemouth complex.

The HSE's Alistair McNab said: "BP has cooperated fully throughout the investigation and has given its commitment to the lessons and messages in the report. Since these incidents, there has been a sustained improvement of safety performance across the Grangemouth complex.

"I am also pleased to say that the UK Petroleum Industry Association, the Chemical Industries Association and the Chemical and Downstream Oil Industry Forum [a tripartite HSE/industry/trades union advisory body] will be encouraging use of the lessons learned from the report as an agent for change in the industry."

Wider messages

Although the report is predominantly about the incidents at the BP Grangemouth complex in 2000, its publication must be seen against the government's Revitalising health and safety strategy (Employers face major health and safety at work shake-up). One of the strategy's aims is to "prevent major incidents with catastrophic consequences occurring in high-hazard industries", and the HSE is taking this opportunity to remind industry of its responsibilities.

Major hazard industries should ensure that the knowledge available from previous incidents - within their own organisations and externally - is incorporated into current safety management systems (see box below). The CA is reinforcing this message because incident investigations often identify and report causes, but no action results. Some major accidents could have been prevented with the correct focus.

It also considers that industries should know of previous major accident histories within their own company and sector. The conclusions and recommendations from published accident investigation reports are designed to ensure that this information is available to a wider audience. If lessons are to be learned, companies need to monitor and implement actions from these reports.

Many companies need to improve their corporate memory so that the knowledge gained from previous incidents is available and heeded by those involved today. Each generation of employees should not have to learn by repeating the mistakes of the past.

Operators should give increased focus to major accident prevention to ensure the control of serious business risk and effective corporate governance. Failure to comply with COMAH, and the associated major accident potential for a site, should be considered a significant business risk that needs to be addressed as part of effective corporate governance. This was discussed in the Turnbull report². Major accidents are intolerable to the public, politicians and the regulators, while lost production, clean-up, fines and damaged reputation can cost companies dearly. Turnbull states that directors should, at least annually, review systems of control including risk management, and financial, operational and compliance controls that are fundamental to the company's business objectives.

The HSE's guidance for directors advises that they should be fully aware of their corporate responsibilities for the control of major accident hazards (Directors take safety on board). Failure by a corporate body and the directors of a company to adequately manage health and safety can lead to prosecution of the company and the individual directors responsible.

The COMAH safety regime is a "living process" and should be used as a management tool to assist in process safety management. Regular inspection of plant, equipment and safety management systems, and regular auditing, are essential in the control and prevention of major accidents. Inspection and auditing must be rigorous and target process safety aspects; the CA will require evidence that these processes are being rigorously applied during the inspection regime under the COMAH Regulations. Inspection and auditing programmes should verify that the descriptions of equipment and management systems contained within the safety reports for major hazard sites are still valid.

The importance of safety cases, which are analagous to safety reports in the COMAH regime, was highlighted in the Cullen report on the Ladbroke Grove rail crash: "While it is clear that the safety case can become over-bureaucratic, it has the potential to be a valuable tool by, for example, bringing about a systematic approach to safety and providing a record of management's commitment to safety. The evidence showed that it [the safety case] can be a 'living document', part of the direct management of safety."

The CA says that companies should use safety reports as a "benchmark" against which to monitor and audit compliance and to ensure that safety standards are being maintained. It also considers that human factors is a relevant COMAH issue that requires consideration in process safety management and in COMAH safety reports. The CA advises that inadequate consideration of human factors is a main cause of the rejection of COMAH safety reports.

¹"Major incident investigation report: BP Grangemouth Scotland: 29 May - 10 June 2000. A public report prepared by the HSE on behalf of the Competent Authority", www.hse.gov.uk/comah/bpgrange/index.htm, free.

²"Internal control: guidance for directors on the Combined Code", Institute of Chartered Accountants for England and Wales, www.icaew.co.uk/internalcontrol, free.